mirror of
https://github.com/langchain-ai/langgraph.git
synced 2026-08-26 17:42:24 +02:00
Mason DaughertyandGitHub
97320843fe
Every third-party GitHub Action in the workflows is now pinned to a full
commit SHA instead of a floating major tag, closing a supply-chain gap
where a mutable tag like `@v6` could be force-pushed to point at
malicious code. Seven actions were already SHA-pinned; this brings the
remaining first-party `actions/*` and `astral-sh/setup-uv` references in
line.
## Changes
- Pinned all previously tag-referenced actions to their current commit
SHA with the exact release as a trailing comment (the format Dependabot
reads and updates): `actions/checkout` → `v6.0.3`,
`actions/setup-python` → `v6.2.0`, `actions/github-script` → `v9.0.0`,
`actions/upload-artifact` → `v7.0.1`, `actions/download-artifact` →
`v8.0.1`, `actions/cache/{restore,save}` → `v5.0.5`,
`actions/configure-pages` → `v6.0.0`, `actions/deploy-pages` → `v5.0.0`,
`actions/upload-pages-artifact` → `v5.0.0`,
`actions/create-github-app-token` → `v3.2.0`, and `astral-sh/setup-uv` →
`v7.6.0`.
- Applied across all workflow files plus the `uv_setup` composite
action; local same-repo references (`./.github/workflows/_*.yml`,
`./.github/actions/uv_setup`) left as path refs since they resolve from
the same commit.
79 lines
2.8 KiB
YAML
79 lines
2.8 KiB
YAML
name: lint
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
working-directory:
|
|
required: true
|
|
type: string
|
|
description: "From which folder this pipeline executes"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
# This env var allows us to get inline annotations when ruff has complaints.
|
|
RUFF_OUTPUT_FORMAT: github
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
matrix:
|
|
# Only lint on the min and max supported Python versions.
|
|
# It's extremely unlikely that there's a lint issue on any version in between
|
|
# that doesn't show up on the min or max versions.
|
|
#
|
|
# GitHub rate-limits how many jobs can be running at any one time.
|
|
# Starting new jobs is also relatively slow,
|
|
# so linting on fewer versions makes CI faster.
|
|
python-version:
|
|
- "3.12"
|
|
name: "lint #${{ matrix.python-version }}"
|
|
steps:
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
- name: Get changed files
|
|
id: changed-files
|
|
if: github.event_name != 'workflow_dispatch'
|
|
uses: Ana06/get-changed-files@25f79e676e7ea1868813e21465014798211fad8c # v2.3.0
|
|
with:
|
|
filter: "${{ inputs.working-directory }}/**"
|
|
- name: Set up Python ${{ matrix.python-version }}
|
|
if: steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch'
|
|
uses: ./.github/actions/uv_setup
|
|
with:
|
|
python-version: ${{ matrix.python-version }}
|
|
cache-suffix: lint-${{ inputs.working-directory }}
|
|
working-directory: ${{ inputs.working-directory }}
|
|
|
|
- name: Install dependencies
|
|
if: steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch'
|
|
working-directory: ${{ inputs.working-directory }}
|
|
run: uv sync --frozen --group lint
|
|
|
|
- name: Analysing package code with our lint
|
|
if: steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch'
|
|
working-directory: ${{ inputs.working-directory }}
|
|
run: |
|
|
if make lint_package > /dev/null 2>&1; then
|
|
make lint_package
|
|
else
|
|
echo "lint_package command not found, using lint instead"
|
|
make lint
|
|
fi
|
|
|
|
- name: Install test dependencies
|
|
if: steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch'
|
|
working-directory: ${{ inputs.working-directory }}
|
|
run: uv sync --group lint
|
|
|
|
- name: Analysing tests with our lint
|
|
if: steps.changed-files.outputs.all || github.event_name == 'workflow_dispatch'
|
|
working-directory: ${{ inputs.working-directory }}
|
|
run: |
|
|
if make lint_tests > /dev/null 2>&1; then
|
|
make lint_tests
|
|
else
|
|
echo "lint_tests command not found, skipping step"
|
|
fi
|